[mnapoli]

Summary

Looking up the organizations a user's bio mentions failed as soon as one of them restricted what GitHub shows our OAuth app: GitHub answered 403 ("the organization has an IP allow list enabled"), the lookup threw, and the user's other mentioned organizations were never looked up. The job then failed after its retries.

Such an organization is now skipped, and the other lookups go on.

Changes

• UpdateMentionedOrganizations skips a lookup only for the org-level refusals HttpGitHubProvider::organizationMembership() already recognizes: the X-GitHub-SSO header, or a message about an IP allow list or OAuth App access restrictions.
• Every other 403 still throws, so the job retries: primary and secondary rate limits (with or without headers), "Resource not accessible by integration", a blocked token.
• A known organization that becomes forbidden is skipped, not deleted. A skipped handle isn't cached as "not an organization".

Validation

Local, on 900ed36 with an isolated PostgreSQL:

• The new tests fail on production (and the rate-limit cases on the first, header-based version of this fix) and pass now.
• composer test:lint, composer test:types: passed (existing oxlint warnings in untouched JS tests).
• composer test:type-coverage: 100%.
• bun run test:unit: 212 passed.
• CI PHP coverage command: 5,131 passed, 100% coverage.

Independent review

Independent agent review: FAIL on a7718ba (secondary rate limits without headers were skipped instead of retried, and other 403s were swallowed). Fixed in 900ed36 with the allow-list above. PASS on 900ed36 against production 9767878.

Limitations

• Two of the three checks match GitHub's wording. If GitHub rewords them, those lookups throw and retry again, as before this change.
• A forbidden handle isn't cached, so it's asked about again on every run and takes one of the five lookup slots.
• The action reads GitHub's error headers and messages itself. Moving that into HttpGitHubProvider behind a dedicated exception would be cleaner, at the cost of a new exception class.

Summary by CodeRabbit

• Bug Fixes
  • Organization lookups now continue when access is blocked by an IP allow list, SAML single sign-on, or OAuth app restrictions, instead of stopping other lookups.
  • Existing private organization information is preserved when an organization cannot be accessed, and restricted organizations are not incorrectly marked as not found.
  • Other request failures, including rate limits and server errors, continue to be reported.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: cbb02a8f-3656-42c9-b87b-079e43b9dd2f

Commits

Reviewing files that changed from the base of the PR and between 9767878 and 900ed36.

Files selected for processing: 3

• app/Actions/UpdateMentionedOrganizations.php
• tests/Unit/Actions/UpdateCommitTopicsTest.php
• tests/Unit/Jobs/LookUpUserOrganizationsTest.php

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

The organization lookup action now skips GitHub lookups blocked by recognized IP allow list, SAML, or OAuth App restrictions. It rethrows other request errors. Tests cover restricted lookups and rate-limit responses.

Changes: Organization lookup error handling

Layer / File(s)	Summary
Handle restricted organization lookups app/Actions/UpdateMentionedOrganizations.php, tests/Unit/Jobs/LookUpUserOrganizationsTest.php, tests/Unit/Actions/UpdateCommitTopicsTest.php	The action skips lookups when a forbidden response identifies an IP allow list, SAML SSO, or OAuth App restriction. It rethrows other request errors. Tests cover continued lookups, unchanged data for inaccessible organizations, and rate-limit and other error responses.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related PRs

• dev-null-sh/dev-null.sh#1266: Introduced the organization lookup action whose error handling this PR changes.
• dev-null-sh/dev-null.sh#1316: Changes the organization lookup action and its organization update contract.
• dev-null-sh/dev-null.sh#1273: Handles organization-level GitHub restrictions in the organization claims flow.

Suggested reviewers: nunomaduro

Merge Risk: Minimal · up to 900ed

The change appears ready to merge with normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: skipping organization lookups when GitHub restricts access instead of failing the entire lookup process.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 3 files.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}